Skip to content
OpenAdvisories

Package · npm

opencode-ai

2 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 8.8
    CVE-2026-22812 Public exploit EPSS 17%

    OpenCode's Unauthenticated HTTP Server Allows Arbitrary Command Execution

    OpenCode is an open source AI coding agent. Prior to 1.0.216, OpenCode automatically starts an unauthenticated HTTP server that allows any local process (or any website via permissive CORS) to execute arbitrary shell commands with the user's privileges. This …

    anomalyco opencode opencode-ai npm